@fastify/multipart - npm Package Compare versions

Comparing version 9.0.2 to 9.0.3

.github/dependabot.yml

@@ -12,3 +12,3 @@ version: 2
     schedule:
-      interval: "weekly"
+      interval: "monthly"
     open-pull-requests-limit: 10

index.js

@@ -455,9 +455,10 @@ 'use strict'
     this.tmpUploads = []
+    let i = 0
     for await (const file of files) {
-      const filepath = path.join(tmpdir, generateId() + path.extname(file.filename))
+      const filepath = path.join(tmpdir, generateId() + path.extname(file.filename || ('file' + i++)))
       const target = createWriteStream(filepath)
       try {
+        this.tmpUploads.push(filepath)
         await pump(file.file, target)
         this.savedRequestFiles.push({ ...file, filepath })
-        this.tmpUploads.push(filepath)
       } catch (err) {
@@ -464,0 +465,0 @@ this.log.error({ err }, 'save request file')

package.json

 {
   "name": "@fastify/multipart",
-  "version": "9.0.2",
+  "version": "9.0.3",
   "description": "Multipart plugin for Fastify",
@@ -5,0 +5,0 @@ "main": "index.js",

test/big.test.js

@@ -46,4 +46,4 @@ 'use strict'
     const memory = process.memoryUsage()
-    t.ok(memory.rss < 400 * 1024 * 1024) // 200MB
-    t.ok(memory.heapTotal < 400 * 1024 * 1024) // 200MB
+    t.ok(memory.rss < 500 * 1024 * 1024)
+    t.ok(memory.heapTotal < 500 * 1024 * 1024)
 
@@ -50,0 +50,0 @@ reply.send()

test/multipart-incomplete-upload.test.js

 'use strict'
 
-const util = require('node:util')
 const test = require('tap').test
@@ -9,8 +8,9 @@ const FormData = require('form-data')
 const http = require('node:http')
-const sleep = util.promisify(setTimeout)
+const { setTimeout: sleep } = require('node:timers/promises')
 const { writableNoopStream } = require('noop-stream')
-const stream = require('node:stream')
-const pipeline = util.promisify(stream.pipeline)
+const { pipeline } = require('node:stream/promises')
+const { once } = require('node:events')
+const fs = require('node:fs/promises')
 
-test('should finish with error on partial upload', async function (t) {
+test('should finish with error on partial upload - files api', async function (t) {
   t.plan(4)
@@ -64,1 +64,48 @@
 })
+
+test('should finish with error on partial upload - saveRequestFiles', async function (t) {
+  t.plan(3)
+
+  const fastify = Fastify()
+  t.teardown(fastify.close.bind(fastify))
+
+  await fastify.register(multipart)
+
+  let tmpUploads
+  fastify.post('/', async function (req) {
+    t.ok(req.isMultipart())
+    try {
+      await req.saveRequestFiles()
+    } finally {
+      tmpUploads = req.tmpUploads
+    }
+  })
+
+  await fastify.listen({ port: 0 })
+  const dataSize = 1024 * 1024 * 1024
+
+  // request
+  const form = new FormData()
+  form.append('upload', Buffer.alloc(dataSize))
+  const opts = {
+    protocol: 'http:',
+    hostname: 'localhost',
+    port: fastify.server.address().port,
+    path: '/',
+    headers: form.getHeaders(),
+    method: 'POST'
+  }
+
+  const req = http.request(opts)
+  const data = form.getBuffer()
+  req.write(data.slice(0, dataSize / 4))
+  req.write(data.slice(dataSize / 4, dataSize / 2))
+  req.end()
+
+  const [res] = await once(req, 'response')
+  t.equal(res.statusCode, 500)
+
+  for (const tmpUpload of tmpUploads) {
+    await t.rejects(fs.access(tmpUpload))
+  }
+})

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Fixed alerts

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

157842

0.73%

Lines of code

4518

0.87%

Number of medium supply chain risk alerts

0

-100%

No dependency changes